137 lines
4.1 KiB
Markdown
137 lines
4.1 KiB
Markdown
# Global Caddy Proxy
|
|
|
|
Use `scripts/register-global-caddy-proxy.sh` to register one cloud's public domains into a shared Caddy proxy.
|
|
|
|
For an end-to-end multi-instance host setup, use:
|
|
|
|
```bash
|
|
./scripts/setup-shared-host-global-caddy.sh
|
|
```
|
|
|
|
If a cloud previously used a nonstandard bundled-SSL HTTPS port such as `444`, make sure its
|
|
no-SSL env is normalized to the shared proxy's real public HTTPS port via `PUBLIC_HTTPS_PORT`
|
|
before syncing overwrite URLs. The helper script does this automatically, defaulting to `443`
|
|
unless you pass `--public-https-port`.
|
|
|
|
This is intended for clouds running the no-SSL stack:
|
|
|
|
- `docker-compose.devprod.nossl.yml`
|
|
- or any equivalent setup where Nextcloud/Broker/optional Office/Talk are published on host ports
|
|
|
|
## Why
|
|
|
|
- One proxy can terminate TLS for multiple cloud instances.
|
|
- Cloud app containers can be recreated independently from the proxy.
|
|
- You avoid running one dedicated TLS proxy container per cloud.
|
|
|
|
## Modes
|
|
|
|
### Register into an existing Caddy config directory
|
|
|
|
If you already have a global Caddy container or host install and its config directory is mounted on disk:
|
|
|
|
```bash
|
|
./scripts/register-global-caddy-proxy.sh \
|
|
--env-file .env.devprod \
|
|
--target-dir /srv/global-caddy \
|
|
--reload \
|
|
--container-name global_caddy
|
|
```
|
|
|
|
Expected layout:
|
|
|
|
- `/srv/global-caddy/Caddyfile`
|
|
- `/srv/global-caddy/sites/`
|
|
|
|
The root `Caddyfile` should import:
|
|
|
|
```caddyfile
|
|
import /etc/caddy/sites/*.caddy
|
|
```
|
|
|
|
If that shared Caddy is running in Docker, its upstream host must be `host.docker.internal`
|
|
instead of `127.0.0.1`, because the no-SSL clouds publish on the Docker host's loopback
|
|
ports, not inside the Caddy container. The registration script now auto-detects the
|
|
bootstrapped container layout and picks `host.docker.internal`; for any other manually
|
|
managed containerized global Caddy, pass:
|
|
|
|
```bash
|
|
--upstream-host host.docker.internal
|
|
```
|
|
|
|
Containerized shared Caddy also requires the no-SSL cloud upstreams to bind on a
|
|
non-loopback host interface. In each cloud env, set at least:
|
|
|
|
```bash
|
|
DEVPROD_HTTP_BIND_HOST=0.0.0.0
|
|
DEVPROD_BROKER_BIND_HOST=0.0.0.0
|
|
```
|
|
|
|
And if those profiles are enabled:
|
|
|
|
```bash
|
|
COLLABORA_BIND_HOST=0.0.0.0
|
|
TALK_RECORDING_BIND_HOST=0.0.0.0
|
|
```
|
|
|
|
Then recreate the no-SSL cloud stack so those new bind hosts take effect.
|
|
|
|
If a cloud env defines one of these:
|
|
|
|
```bash
|
|
QORTAL_PUBLIC_GATEWAY_URL=
|
|
QORTAL_GATEWAY_PUBLIC_URL=
|
|
QORTAL_GATEWAY_URL=
|
|
```
|
|
|
|
the registration script will also publish a Qortal gateway site block for that host,
|
|
proxied to `QORTAL_NODE_GATEWAY_HOST_PORT`. For a containerized shared Caddy, set:
|
|
|
|
```bash
|
|
QORTAL_NODE_GATEWAY_BIND_HOST=0.0.0.0
|
|
```
|
|
|
|
### Bootstrap a standalone shared Caddy container
|
|
|
|
```bash
|
|
./scripts/register-global-caddy-proxy.sh \
|
|
--env-file .env.devprod \
|
|
--target-dir ./deploy/global-caddy \
|
|
--bootstrap \
|
|
--start \
|
|
--reload \
|
|
--container-name global_caddy
|
|
```
|
|
|
|
This creates:
|
|
|
|
- `deploy/global-caddy/Caddyfile`
|
|
- `deploy/global-caddy/docker-compose.yml`
|
|
- `deploy/global-caddy/sites/`
|
|
- `deploy/global-caddy/data/`
|
|
- `deploy/global-caddy/config/`
|
|
|
|
The bootstrapped container proxies to `host.docker.internal`, so it can reach the host-published cloud ports.
|
|
|
|
## Defaults
|
|
|
|
- Existing/non-bootstrap target: upstream host defaults to `127.0.0.1`
|
|
- Bootstrapped container target: upstream host defaults to `host.docker.internal`
|
|
- Site file id defaults from `NEXTCLOUD_DOMAIN`
|
|
|
|
## Notes
|
|
|
|
- Optional `office` and `talk` site blocks are only generated when those profiles are enabled in `COMPOSE_PROFILES`.
|
|
- For `office`, run `scripts/ensure-nextcloud-office-config.sh` after proxy/domain changes to enable `richdocuments` and align `wopi_url` / `public_wopi_url`.
|
|
- Talk signaling proxies to the host-published `TALK_SIGNALING_PORT`. The
|
|
`talk_hpb` container target remains `TALK_SIGNALING_CONTAINER_PORT=8081`,
|
|
which lets multi-instance hosts use unique public signaling ports.
|
|
- TURN traffic is still direct on `TALK_TURN_PORT`; it is not proxied through Caddy.
|
|
- After moving a cloud behind an external/global proxy, run:
|
|
|
|
```bash
|
|
./scripts/ensure-nextcloud-url-config.sh \
|
|
--compose-file docker-compose.devprod.nossl.yml \
|
|
--env-file .env.devprod
|
|
```
|